Which two statements correctly describe GitHub artifact attestations in Actions workflows? (Choose two)
Select all correct answers, then click Submit.
Short Explanation
Attestations are about proving how a build artifact was produced — provenance for supply-chain security — not a substitute for IAM or a fork ban. Use them with signing/verification policies in deploy pipelines so prod only accepts builds from trusted workflows.
Full Explanation
The correct answers are verifiable provenance metadata and binding artifacts to build claims for supply-chain integrity. Artifact attestations complement SBOMs and signing strategies by recording how and where a binary was produced in GitHub Actions. Option B is false; access control remains mandatory and attestations do not replace IAM. Option D is false; attestations do not ban forks. Administrators should standardize attestation generation in reusable workflows, pin trusted builders, and enforce verification at deployment gates so production only accepts artifacts with expected provenance.